CVE-2026-97290

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

EUVD-2026-90217

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290 WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-97290

The Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin, in versions

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions = 3.36...

CVE-2026-97290: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

PT-2026-103506

Unauthenticated Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.36 versions...

CVE-2026-18276 Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-54418 Leantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass

Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-supplied userId parameter with no ownership check, session pinning, or permission-attribute gate unlike other RPC-exposed methods in the sa...

CVE-2026-15227

Missing authorization in Checkmk 2.5.0p10, 2.4.0p35, 2.3.0p49, and 2.2.0 EOL allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users...

CVE-2026-12697

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user...

EUVD-2026-51000

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

PT-2026-66399

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

PT-2026-66398

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

EUVD-2026-50136

An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user without authorisation, disclosing private learning progress information...

CVE-2026-66434: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the updateUser process of the API endpoint, which fails to enforce proper authorization checks for editing superuser accounts and changing user passwords. An attacker can gain full administrative access by sendi...

GHSA-H4HF-V6W5-897X Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account

Summary The REST API user-update endpoint PUT/PATCH /api/v2/users/id and the V1 equivalent does not enforce two authorization rules that the web interface enforces. A user who holds the usereditothers permission but is not a superuser can: 1. edit user accounts that belong to a superuser, and 2...

PT-2026-57819

Name of the Vulnerable Software and Affected Versions Skillable affected versions not specified Description A flaw in the lab platform allows for the forgery of a client-supplied identifier to bypass per-user lab launch limits. By modifying the userId variable provided by the browser, an attacker...